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-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

• If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

• Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)^ Responsive to communication(s) filed on 26 July 2001 . 
2a)D This action is FINAL. 2b)M This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) Kl Claim(s) 1-24 is/are pending in the application. . 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) M Claim(s) 1-24 is/are rejected. 

7) K Claim(s) 19-20 is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) K The specification is objected to by the Examiner. 

10) K The drawing(s) filed on 31 July 2002 is/are: a)|^ accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) ^ Notice of References Cited (PTO-892) 4) □ Interview Summary (PTO-413) 

2) □ Notice of Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) □ Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5) □ Notice of Informal Patent Application (PTO-152) 

Paper No(s)/Mail Date . 6) O Other: . 
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This action is in response to the communication filed on 07/26/2001. 



DETAILED ACTION 



1. 



Claims 1-24 have been examined. 



Title 



2. 



The title of the invention is acceptable. 



Priority 



3. 



No claim for priority has been made for this application. 



4. The effective filing date for the subject matter defined in the pending claims in this 
application is 07/26/2001 . 

Drawings 

5. The drawings filed on 7/3 1/2002 are acceptable for examination proceedings. 

Specification 

6. Applicant is reminded of the proper language and format for an abstract of the disclosure. 

The abstract should be in narrative form and generally limited to a single paragraph on 
a separate sheet within the range of 50 to 150 words. It is important that the abstract not exceed 
150 words in length since the space provided for the abstract on the computer tape used by the 
printer is limited. The form and legal phraseology often used in patent claims, such as "means" 
and "said, " should be avoided. The abstract should describe the disclosure sufficiently to assist 
readers in deciding whether there is a need for consulting the full patent text for details. 

The language should be clear and concise and should not repeat information given in the 
title. It should avoid using phrases which can be implied, such as, "The disclosure concerns, " 
"The disclosure defined by this invention, " "The disclosure describes, " etc. 

7. The abstract of the disclosure is objected to because 

Lines 4-6: "The sending of... mass mailing malware" must be removed, as it is not 
directed towards the technical disclosure of the invention or that which is new. 



Correction is required. See MPEP § 608.01(b). 
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Claim Objections 

8. The applicant is reminded that a series of singular dependent claims is permissible in 
which a dependent claim refers to a preceding claim which, in turn, refers to another preceding 
claim. 

A claim which depends from a dependent claim should not be separated by any claim 
which does not also depend from said dependent claim. It should be kept in mind that a 
dependent claim may refer to any preceding independent claim. In general, applicant's sequence 
will not be changed. See MPEP § 608.01(n). 

9. Claims 19-20 are objected to because claim 19 recites the limitation "Apparatus as 
claimed in claim 1" in line 1. The examiner feels that the claim was meant to depend on claim 
17 but instead depends on claim 1 merely due to a typographical error. This would be consistent 
with claims 3 and 1 1 depending on claims 1 and 9 because claim 17 is the independent apparatus 
claim. Claim 20 is objected to by virtue of its dependency to claim 19. For the purposes of 
searching art, the examiner will assume the claim was meant to depend on claim 17. 

Claim Rejections - 35 USC § 102 

10. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for 
patent or (2) a patent granted on an application for patent by another filed in the United 
States before the invention by the applicant for patent, except that an international 
application filed under the treaty defined in section 351(a) shall have the effects for 
purposes of this subsection of an application filed in the United States only if the 
international application designated the United States and was published under Article 
21(2) of such treaty in the English language. 
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11. Claims 1-3, 5, 7, 9-11, 13, 15, 17-19, 21, and 23 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Marsh (US Patent Number 6.763,462). 
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12. Regarding claims 1, 9, and 17, Marsh disclosed a method, apparatus, and program (See 
Marsh Claims) operable to control an e-mail client computer to detect e-mail propagated 
malware (See Marsh Abstract), comprising: e-mail generating logic operable to generate an e- 
mail message (See Marsh Col. 2 Lines 1 1-25); comparison logic operable to compare said e-mail 
message with at least one of an address book of a sender of said e-mail message (See Marsh Col. 
1 Lines 61-64 and Col. 2 Lines 44-46) and one or more previously generated e-mail messages 
from said client computer (See Marsh Col. 3 Lines 62-65); and identifying logic operable to 
identify said e-mail message as potentially containing malware if at least one of: (i) said e-mail 
message is being sent to more than a threshold number of addressees specified within said 
address book (See Marsh Col. 1 Lines 61-64 and Col. 2 Lines 44-46, and Col. 3 Lines 13-34); 
(ii) said e-mail message contains message content having at least a threshold level of similarity 
to message content of said previously generated e-mail messages being sent to more than a 
threshold number of addressees specified within said address book; and (iii) said e-mail message 
contains message content having at least a threshold level of similarity to message content of 
more than a threshold number of said previously generated e-mail messages. 

13. Regarding claims 2, 10, and 18, Marsh disclosed that wherein said e-mail message 
specifies a plurality of addressees, said comparison logic being operable to compare said 
plurality of addressees with said e-mail address book to determine if said at least a threshold 
number of addressees has been exceeded (See Marsh Col. 2 Lines 39-46 and Col. 3 Lines 15-34). 

14. Regarding claims 3,11, and 19, Marsh disclosed that said at least a threshold number of 
addressees is specified as a proportion of addressees within said address book (See Marsh Col. 2 
Lines 58-61). 
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15. Regarding claims 5, 13, and 21, Marsh disclosed quarantine queue logic operable to hold 
said previously generated e-mail messages in a quarantine queue for at least a predetermined 
quarantine period prior to being sent from said client computer (See Marsh Col. 3 Lines 18-24, 
35-43 and 50-57 wherein Marsh disclosed comparing outgoing messages for a certain period of 
time, two minutes, and if the threshold was reached during that time, the message was deleted 
and not sent, which implied that the message was held for the specified period of time before 
being sent). 

16. Regarding claims 7, 15, and 23, Marsh disclosed confirmation input logic operable when 
said e-mail message is identified as potentially containing malware to generate a user message 
seeking a confirmation input from a user of said client computer before said e-mail message is 
sent (See Marsh Col. 3 Lines 35-43). 

Claim Rejections - 35 USC § 103 

17. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person having ordinary 
skill in the art to which said subject matter pertains. Patentability shall not be negatived 
by the manner in which the invention was made. 

18. Claims 4, 6, 12, 14, 20, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Marsh as applied to claims 1, 9, and 17 above, and further in view of Bates et al. (US Patent 
Number 6,785,732) hereinafter referred to as Bates. 
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Marsh disclosed both a proportion of addresses (See rejection of claim 3 above) and a 
specified time period (See rejection of claim 7 above) but failed to disclose the proportion and 
the time period could be user specified. 

Bates teaches that in a virus checker, a users can specify preferences about the virus 
checking (See Bates Col. 8 Lines 49). 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Bates in the virus detector of Marsh by allowing the user to 
specify the proportion and the time period used for determining a threat. This would have been 
obvious because the ordinary person skilled in the art would have been motivated to allow the 
user of the virus checker to specify how the checker would operate. 
19. Claims 8, 16, and 24 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Marsh as applied to claims 1, 9, and 17 above, and further in view of Kouznetsov (US Patent 
Number 6,725,377). 

Marsh disclosed sending alert an alert to a user upon detection of possible virus activity 
(See Col. 3 Lines 18-22), but failed to disclose sending an alert to an administrator upon 
detection of possible virus activity. 

Kouznetsov teaches that in computer intrusion detection systems, when attack 
characteristics are detected, it is typical to notify an administrator of the detection (See 
Kouznetsov Col. 1 Paragraph 6). 

It would have been obvious to the ordinary person skilled in the art at the time of 
invention to employ the teachings of Kouznetsov in the virus detection system of Marsh by 
alerting an administrator of detected possible virus activity. This would have been obvious 
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because the ordinary person skilled in the art would have been motivated to provide the 
administrator with the knowledge of the possible attack in order for the administrator to take 
appropriate action. 

Conclusion 

20. Claims 1-24 have been rejected. 

21 . The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

a. Shipp (Patent Application Publication Number 2004/0054498) disclosed a method 
for detecting a virus outbreak by monitoring e-mail traffic patterns, including monitoring 
for duplicate or similar messages being sent in a specified period of time. 

b. Hockey (Patent Application Publication Number 2004/00645 1 5) disclosed a 
method for detecting denial of service attacks, worms, and spam by monitoring for 
duplicate messages using message digests. 

c. Algomy et al. (Patent Application publication Number 2002/0194489) disclosed a 
method for containing viruses including monitoring for messages being sent to decoy 
addresses in an address book. 

d. Milliken et al. (Patent Application Publication Number 2004/0073617) disclosed 
a method for monitoring e-mail for virus activity involving checking for replicated 
content. 

22. Please direct all inquiries concerning this communication to Matthew Henning whose 
telephone number is (571) 272-3790. The examiner can normally be reached Monday-Friday 
from 9am to 4pm, EST. 
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If attempts to reach examiner by telephone are unsuccessful, the examiner's acting 
supervisor, Ayaz Sheikh, can be reached at (571) 272-3795. The fax phone number for this 
group is (703)305-3718. 

Any inquiry of general nature or relating to the status of this application or proceeding 
should be directed to the Group receptionist whose telephone number is (703) 305-3900. 





Matthew Henning 
Assistant Examiner 
Art Unit 2131 




